Changeset 252511 in webkit

Timestamp:

Nov 15, 2019 4:05:01 PM (4 years ago)

Author:

jer.noble@apple.com

Message:

CRASH in SourceBuffer::removeCodedFrames()
​https://bugs.webkit.org/show_bug.cgi?id=204248

Reviewed by Eric Carlson.

Speculative fix for rare crash. It's possible that the startTime and endTime inputs to
removeCodedFrames() are out-of-order, which could lead to iterating off the end of the
SampleMap. Verify that startTime < endTime and bail out early if not true.

• Modules/mediasource/SourceBuffer.cpp:

(WebCore::SourceBuffer::removeCodedFrames):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/mediasource/SourceBuffer.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-11-15  Jer Noble  <jer.noble@apple.com>
+
+        CRASH in SourceBuffer::removeCodedFrames()
+        https://bugs.webkit.org/show_bug.cgi?id=204248
+
+        Reviewed by Eric Carlson.
+
+        Speculative fix for rare crash. It's possible that the startTime and endTime inputs to
+        removeCodedFrames() are out-of-order, which could lead to iterating off the end of the
+        SampleMap. Verify that startTime < endTime and bail out early if not true.
+
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::removeCodedFrames):
+
 2019-11-14  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp

@@ -802 +802 @@
     DEBUG_LOG(LOGIDENTIFIER, "start = ", start, ", end = ", end);
 
+    ASSERT(start < end);
+    if (start >= end)
+        return;
+
     // 3.5.9 Coded Frame Removal Algorithm
     // https://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html#sourcebuffer-coded-frame-removal